james_richards Posted February 9, 2009 Posted February 9, 2009 Hi All, I am really sorry for disturbing you all, I need you help please. I am a Junior ICT Technician at a school and I have the following problem: We run a proxy which all pupils are forced through via the domain group policy, some of the pupils have figured out the old remove network cable at logon trick so the group policy fails but they still get logged on to a desktop. You have talked about this problem in a previous forum but to be honest I did not understand it because at the moment I am only a junior technician. Can you please if you got time, give me instructions on how I can overcome this problem? I would really appreciate it if you could help me out, please. A lot of people mentioned something about having a Logoff Script at the Startup menu, can you please if it is possible tell me the kind of information I need to have in this file? What extension I need to save the file as? And which software is used to create this file? I really need someone’s help because at the moment my ICT manager has gone on a long stress sick leave. Thank You in Advance! Regards, James
6Foot2 Posted February 9, 2009 Posted February 9, 2009 (edited) I think what you are looking for is a Group policy setting which prevents logon with a default profile when the server 'appears' to be unavailable. Not sure exactly where to find this as I am looking into it myself at the moment [also fighting other more pressing issues] If nobody else gets back to you I will post a fuller answer as soon as I find it. Best of luck. Edited February 9, 2009 by 6Foot2 Correct post entry. 1
Michael Posted February 9, 2009 Posted February 9, 2009 If you're familiar with Group Policies, this policy should help: Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled 2
james_richards Posted February 9, 2009 Author Posted February 9, 2009 I think what you are looking for is a Group policy setting which prevents logon with a default policy when the server 'appears' to be unavailable. Not sure exactly where to find this as I am looking into it myself at the moment [also fighting other more pressing issues] If nobody else gets back to you I will post a fuller answer as soon as I find it. Best of luck. Thank You for your help!
james_richards Posted February 9, 2009 Author Posted February 9, 2009 If you're familiar with Group Policies, this policy should help: Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled Thank You Michael, i really appreciate it. Is that all i have to do? I will give it a shot tomorrow hopefully it will work. Once again thank you.
Michael Posted February 9, 2009 Posted February 9, 2009 If you have further problems, feel free to come back and keep us updated
james_richards Posted February 9, 2009 Author Posted February 9, 2009 If you have further problems, feel free to come back and keep us updated Thank You once again thats really nice of you.
NeoPlosive Posted February 9, 2009 Posted February 9, 2009 If you're familiar with Group Policies, this policy should help: Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled Also a nice one is: Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled Computer Configuration > Admin Templates > System > Network Connectivity Electric shock when network connectivity fails during logon process - Enabled 1
rvdmast Posted February 9, 2009 Posted February 9, 2009 by far the most effective method to disable bypassing the proxy is to make sure your proxy is the only possible route to the internet. You could achieve this two ways: 1: Use a transparent proxy, one with two NIC's one facing the internet, one facing your LAN. Any data traveling from or to the internet HAS to go through this proxy. 2: If your proxy server has only one NIC, then configure your firewall (wich, i assume, is a separate box) so that outgoing HTTP(S) connections are ONLY allowed from the IP address of your proxy. deny clients direct outgoing connections. This way, if they somehow disable the browser's proxy setting, they'll simply have no internet at all. That'll take away the fun very soon...
mrcrazy04 Posted February 9, 2009 Posted February 9, 2009 by far the most effective method to disable bypassing the proxy is to make sure your proxy is the only possible route to the internet. You could achieve this two ways: 1: Use a transparent proxy, one with two NIC's one facing the internet, one facing your LAN. Any data traveling from or to the internet HAS to go through this proxy. 2: If your proxy server has only one NIC, then configure your firewall (wich, i assume, is a separate box) so that outgoing HTTP(S) connections are ONLY allowed from the IP address of your proxy. deny clients direct outgoing connections. This way, if they somehow disable the browser's proxy setting, they'll simply have no internet at all. That'll take away the fun very soon... I agree with that - if they're sneaky they come up with all sorts of ways to change the proxy server settings (if you have VBA enabled they can use that to call the WSH libraries), so if they're forced through one it's made a little bit harder!
dalsoth Posted February 9, 2009 Posted February 9, 2009 Perhaps remove the default gateway if it is set on the DHCP server for the clients. If the students log on by pulling out the network cable and then untick the school proxy or load portable Firefox or other stuff to bypass the school proxy this may help.
nicholab Posted February 10, 2009 Posted February 10, 2009 Cut down the locking tab of the ethernet cable. You can then only remove it with a small screw driver.
Paul_L Posted February 10, 2009 Posted February 10, 2009 Cut down the locking tab of the ethernet cable. You can then only remove it with a small screw driver. Yep! my prefered method, just remember to do both ends!
james_richards Posted February 10, 2009 Author Posted February 10, 2009 Hi all, I went to school today and i tried the following method: ""Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled"" The method above did not work i tried the cable trick and it did not log the user off, am I doing something wrong? Thanx
SteveMC Posted February 10, 2009 Posted February 10, 2009 Hi all, I went to school today and i tried the following method: ""Computer Configuration > Admin Templates > System > User Profiles Log users off when roaming profile fails - Enabled"" The method above did not work i tried the cable trick and it did not log the user off, am I doing something wrong? Just to check, - you are making these changes to a Group Policy Object (GPO) that is applied to the Computers, and not just the Users? (if you've not already got it installed, Microsoft's Group Policy Management Console is an invaluable tool for sorting out policies). Also, just checking that your users do have roaming profiles assigned to them? (look at the user properties in Active Directory Users and Computers) If they don't then that policy setting probably won't have any effect. Stephen 1
james_richards Posted February 10, 2009 Author Posted February 10, 2009 Just to check, - you are making these changes to a Group Policy Object (GPO) that is applied to the Computers, and not just the Users? (if you've not already got it installed, Microsoft's Group Policy Management Console is an invaluable tool for sorting out policies). Also, just checking that your users do have roaming profiles assigned to them? (look at the user properties in Active Directory Users and Computers) If they don't then that policy setting probably won't have any effect. Stephen Thank You Stephen for your help and time i really appreciate it. I will give this a try.
flexyjerkov Posted February 11, 2009 Posted February 11, 2009 Can you not edit the default profile to run: logoff on startup?
Oops_my_bad Posted February 14, 2009 Posted February 14, 2009 Also, just checking that your users do have roaming profiles assigned to them? (look at the user properties in Active Directory Users and Computers) If they don't then that policy setting probably won't have any effect. yeh was going to say... we use local profiles so I guess this group policy setting wouldnt work for us?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now